A retrieved document may contain text that looks like an instruction to the assistant. That text must not inherit the user's authority or change the system's operating rules.
Describe the unwanted outcome
In a fictional example, an uploaded document tells the assistant to send other files to an external address. The user requested a summary, not a transfer. The boundary separates content to interpret from an authorised action.
| Surface | Control to consider |
|---|---|
| Retrieved documents | Treat their content as untrusted input |
| Available tools | Limit capabilities to the intended workflow |
| Accessible records | Enforce the requesting user's permissions |
| External actions | Review scope and content before authorisation |
Test effects, not only wording
Include documents with forged instructions, secret requests and misleading links. Inspect the entire workflow. A refusal in the final response is insufficient if a tool has already executed the action.
Can a prompt instruction solve the problem alone?
No. Restrict capabilities, validate tool parameters and enforce access outside the model. Separate reading from execution, record relevant actions and provide a stop mechanism. This is a scoping checklist for defensive work, not a substitute for a specialist review of the application and its integrations.
Test cross-language instructions too
A malicious instruction may appear in a different language from the user's request or inside a quoted email. Include such cases in defensive testing. The trust boundary should depend on the source and authorised task, not on whether the instruction looks familiar.
Sources and further reading
From this guide to your project
AI ↗
We start with a task and a quality criterion. AI belongs where it meaningfully improves the service.
Tell us about your ideaExamples are educational and do not describe client results. Content prepared with AI assistance; see our editorial policy. Our method ↗